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FIG. 3 
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M: READ HISTORICAL DATA 



A, M: LEARN RULE LEFT-HAND SIDE 



r- t • 



A=ANALYST 
M=MACHINE 
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A: ADD RULE RHS AND 
EVALUATE RESULT 
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M: PUT NEW RULE INTO 
RULE DATABASE 



FIG. 4 
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A: ADD RULE RHS 
AND EVALUATE 
RESULT 



A=ANALYST 
M=MACHINE 
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A: MARK ONE OR MORE EVENT GROUPINGS 
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M: LEARN CONCEPT FROM POSITIVE 


AND NEGATIVE EXAMPLES 




^^^\k\ SUFFICIENT^^^^ 
<^CONFIDENCE IN CONCEPT Z>* 
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M: DO SIMILARITY QUERY BASED ON 
POSITIVE AND NEGATIVE EXAMPLES 
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A: CRITIQUE AND/OR AUGMENT 
GROUPINGS FOUND, BOTH POSITIVE AND 
NEGATIVE EXAMPLES 
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A: ADJUST PARAMETERS OF LEARNER 
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FIG. 8 



HOST 




EVENTS SELECTED BY USER 



TRUE CONCEPT 
HOST IS ON 15.2.3 
RATE > .5/sec 



5 9 TIME 

A, B, C ARE HUBS ATTACHED TO SUBNET 15.2.3 

X IS NOT A HUB AND IS ON 15.2.3 

D IS A HUB BUT IS NOT ATTACHED TO 15.2.3 



FIG. 9 




NEW PATTERNS FOUND 
BY MACHINE 



TIME 

A, B, C ARE HUBS ATTACHED TO SUBNET 15.2.3 

X IS NOT A HUB AND IS ON 15.2.3 

D IS A HUB BUT IS NOT ATTACHED TO 15.2.3 



TRUE CONCEPT 
HOST IS ON 15.2.3 
RATE > .5/sec 



CONCEPT RETRIEVED 
HOST IS A HUB 
RATE > .75/sec 
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FIG. 1 0 




PATTERN EDITED BY END-USER 



TRUE CONCEPT 
HOST IS ON 15.2.3 
RATE > .5/sec 



TIME 

A, B, C ARE HUBS ATTACHED TO SUBNET 15.2.3 

X IS NOT A HUB AND IS ON 15.2.3 

D IS A HUB BUT IS NOT ATTACHED TO 15.2.3 



FIG. 1 1 
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